The DMZ

« first day (1700 days earlier) ← previous day next day → last day (3478 days later) »

TildalWave

20:15

Folks say hi to @duzzy ... I told him this would be the place for his question:

I've been thinking of setting up a small isolated network in my apt for the sake of playing around and figuring out how to defend it from this and that (it would be a long term project so nothing specific right now). I'm just really in the stage where it's an idea that I think would be interesting, and was thinking of looking for some advice.

pen testing lab I guess?

duzzy

For purposes related to this question, basically, yeah.

Ohnana

all of the virtual machines at the same time

TildalWave

It's not something I'd have tons of experience in, but I'd start with some sandbox / virtualization environment

Ohnana

also get a cheap router to segment yourself from the general internet connection (if you share/lease a connection)

AAAAND don't the connect vms to the internet, disable that shit in the settings

duzzy

I've played around a lot with VMs for school, but never for this purpose.

Ohnana

20:21

okay, so you're familiar with the concept

sourceforge.net/projects/lampsecurity/files/CaptureTheFlag

^^ these are capture the flag excercises written by my former boss

they're in prebuilt containers, and each one comes with a guide on how to do things

duzzy

Oh wow. Those look really cool!

Thank you.

Ohnana

20:35

no problemo

something to cut your teeth on at least

duzzy

Yeah, I have to start somewhere. That looks like a fun place to start.

Rоry McCune

20:47

@duzzy Some other ones to look at owasp.org/index.php/OWASP_Security_Shepherd - OWASP Security Shepherd has a bunch of challenges

Also dvwa.co.uk Darn Vulnerable Web App

For pre-configured security tools in a linux distro, Kali kali.org is the default way to go these days

duzzy

Ah, nice. Thank you for those.

I have kali on a liveboot usb device. I haven't done a whole lot with it yet, though.

Rоry McCune

worth noting that there's a new major version (kali 2) just out now

one of the main tools that gets used for offensive stuff is Metasploit. There's a free training course about it offensive-security.com/metasploit-unleashed here

Ali Shaikh

Hi, I have a question. I got this number of a recruiter off of a website and upon messeging him he asked me to email him his CV. After that he requested copy of my visa, passport and certificate which I sent him. I am just starting to worry that what if they use my documents for identity fraud? what can I do in this case?

duzzy

@RоryMcCune Awesome. Thank you!

Rоry McCune

@duzzy np. There's a loooaad of good free or cheap resources out there these days, so lots of stuff to look at

David Freitag

20:53

mmmmmm sammich

Ohnana

@AliShaikh oh god what the fuck did you do

Q: What harm can be done with a copy of one's passport?

In one of the questions on this site, it was suggested the use of Dropbox to save a backup copy of your passport, in case you need to proof who you are if your original document is lost. I like the idea, but what if someone gets access to your Dropbox folders and is able to acquire the copy of ...

put a credit freeze on your accounts: experian.com/fraud/center.html

what certificate did you hand them?

Iszi

@Ohnana Fair bet it's "birth".

Ohnana

in that case: quora.com/…

Iszi

So, there goes mother's maiden name and place of birth...

Ohnana

and you can get damn near anything with one. same as a passport

Iszi

21:05

I'm guessing @AliShaikh is not American, or at least not native, by his use of the term "CV". So, no worries over SSN but perhaps the passport/visa might have similarly sensitive national ID numbers?

Ohnana

@Iszi cv is an american term, it's the resume you write once you get a PHD

Iszi

@Ohnana Probably 98% of Americans just say "resume". I've only consistently heard Brits (or others from across the pond) call it a CV.

Ohnana

i see.

David Freitag

@Iszi Also them there Canadihueans.

Iszi

@DavidFreitag Aren't they technically still Brits?

Ohnana

21:07

i thought they were honorary french

Iszi

(Goes to look up CGP Grey video.)

Gilles

Q: How can I detect if someone is breaking my license terms?

If this question is about what we are supposed to do if someone is breaking the terms of a software license, I would like to know how I can know if some is doing so. Suppose that I'm writing a software with a GPL license. It is a copyleft license. It is not allowed to use the code in a non-free...

copyleft software enforcement

Oracle: “because they send you pentesting reports”

David Freitag

@Gilles That's not true, reports run on static binaries is perfectly acceptable.

Iszi

@Ohnana They're part of the Commonwealth Realm, and are an independent nation. So, sort-of British, but not actually British.

Rоry McCune

@DavidFreitag for Oracle, acceptable from a EULA perspective, perhaps, but they're actively asking people not do to testing on their products even where it doesn't breach the EULA

David Freitag

21:14

@RоryMcCune Just because it isn't a breach of license terms doesn't mean it isn't annoying.

Rоry McCune

@DavidFreitag from oracle's standpoint sure I can see it being annoying, but then they have a terrible record on security and from tests I've done on systems built on their products, vulnerabilities are common

so it's in their customers interests to do the work

of course there will be bad reports and False-positives but what's the alternative, take Oracle's word for it..........

David Freitag

@RоryMcCune Java? Terrible security? Surely you're mistaken...

Rоry McCune

@DavidFreitag I'm hoping you just missed off the smiley there :op

David Freitag

@RоryMcCune Hehehe, yes :]

Lucas Kauffman

Did someone say boobies?

David Freitag

21:18

@LucasKauffman Boobies? Yeah.... Boobies.

Iszi

Lucas Kauffman

@Iszi I prefer tits

here's a pair of tits

David Freitag

Best pair of tits I've seen in quite some time.

Michael Schumacher, Germany

567 2 17

licensing localization marketing monetization philosophy software source-code

Iszi

@DavidFreitag That does not appear to relate to tits nor boobies. What's going on here?

David Freitag

@Iszi If you squint real hard that person's avatar looks like tits.

Iszi

21:23

@DavidFreitag You need your eyes checked.

David Freitag

@Iszi You just aren't squinting hard enough.

Ohnana

@DavidFreitag wtf get glasses nerd

David Freitag

Of course, it could be the large amount of LSD I just consumed.

Herringbone_Cat

@DavidFreitag eh <400mcg you'll be fine

David Freitag

@Herringbone_Cat How much is that? Is a gallon too much?

Herringbone_Cat

21:29

@DavidFreitag Depends how much crystal was placed into that gallon jug, and if the water was distilled or not. :)

AFAIK acid chemists prefer cheap vodka, so you'd be rather drunk after a gallon

Ohnana

@DavidFreitag that's equivalent to about 4 marijuana injections!!!!

David Freitag

@Ohnana Yeah, I did a beer once.

Rory Alsop

Lol

Flyk

22:21

...and as the noise began in the hallway, and I was disturbed from the best sleep I've had in a while, my initial waking thought was "don't wake up, don't wake up, don't wake up... dammit."

step 1: coffee